3 ms·

How do you know none of your sdk/deps doesn't either?

• ryandrake 3y ago
  Yours is a good question, and probably one of the places I'd look first. It doesn't deserve to be downvoted. Too many developers just yeet rando dependencies into their app without even remotely vetting/auditing them.
  • ndr 3y ago
    It's a sad truth, and extremely hard for small devs. Google and Apple are well positioned to help everyone do better here, but the game-theory doesn't make being transparent any easier.
• alias_neo 3y ago
  I work for the kind of employer, who has the kind of customers who won't allow us to leave this sort of thing up to chance. I can't be more specific, as I'm not authorised to speak on behalf of, or represent my employer; my words/opinions are my own etc. We know, because we have to know.
  • ndr 3y ago
    I didn't mean it was up to chance, it is technically quite hard to keep in check. At most places the most serious bit is some sort of compliance checks with vendors. And while that might carry legal consequences it's technically a pinky-promise. Nothing in the system enforces it in any way. Unless one does some technical analysis on every version of every deps one uses, a dep (maybe via one of its deps) can get compromised and how/when will anyone notice it? It is a technical challenge, and almost impossible for small devs. If you have a process in place to tackle this I'd love to learn about it, even if it has to stay in general terms.